pi-daddy 0.14.0 → 0.15.0

package/CHANGELOG.md

@@ -93,6 +93,38 @@ resolution, enforcement, approvals or the ledger changed — this is the part be
   defect as the `exports` map that worked in the tree and threw for every consumer, and the second time that
   script has caught it.
 
+## 0.15.0 — `/grants init`, a grant that survives without an env var, and a setup that was wrong
+
+**Setup is two steps instead of five, and one of the five was wrong.**
+
+```bash
+pi install npm:pi-daddy
+pi install npm:principal-pi-skills
+pi
+/grants init
+```
+
+- **`pi install`, not `npm install`.** This package's own documentation said `npm install`, and that is not
+  how pi packages are installed: `pi install` registers the package in pi's settings, which is what makes
+  the extension auto-load, and it installs to `$PI_CODING_AGENT_DIR/npm/node_modules` rather than the
+  project. **`init` searched only the project and so found nothing for anyone who followed pi's own
+  instructions** — telling them to install a package they had just installed. It now searches both roots,
+  project first so a pinned copy outranks the machine-wide one.
+- **`/grants init`** scaffolds definitions, asks about the capabilities that can change your machine, and
+  applies the answer to the session you are already in — **no `source`, no restart**.
+- **A grant can now come from a store**, at `$PI_CODING_AGENT_DIR/grants/<project>.json` — **outside** your
+  project, because a ceiling a child holding `tool:write` could rewrite is not a ceiling. `PI_GRANTS_GRANT`
+  **always wins**: it is how a child is governed and how CI is configured. `.pi/grants.env` is still written
+  and still worth committing — it is the reviewable record, no longer what the enforcer reads. (ADR-0030)
+- **The dialog does not ask questions whose answers cannot matter.** `tool:bash` subsumes `write` and
+  `edit`, so once bash is granted those are conferred; asking anyway let an operator answer *no* to
+  `tool:write` and then watch `build` be allowed it. It now reports them as already conferred instead.
+- **An unknown `/grants` subcommand is refused rather than ignored.** `/grants init` used to print the
+  ordinary status screen with the word silently dropped, so a command that did not exist looked like it had
+  worked.
+- **`init` counted authorisations and called them declarations** — "7 skill(s), 3 declaring allowed-tools"
+  when all seven declared.
+
 ## 0.13.0 — the approvals file gets the lock the ledger already had, and two silences end
 
 Closing the last items that were open rather than out of scope, then **red-teaming the result**: an

package/README.md

@@ -339,10 +339,18 @@ installed. Every transcript below is **copied from a run**, not retyped — the
 this section abridges output it says so.
 
 ```bash
-npm install pi-daddy principal-pi-skills
-npx pi-daddy init
+pi install npm:pi-daddy
+pi install npm:principal-pi-skills
+pi                      # then, inside pi:
+/grants init
 ```
 
+**`pi install`, not `npm install`** — it registers the package with pi, which is what makes the extension
+auto-load; presence in `node_modules` alone does nothing. `/grants init` asks only about the capabilities
+that can change your machine and applies the answer to the running session, no restart (ADR-0030).
+`npx pi-daddy init` does the same scaffolding from a shell, and both search pi's install root as well as
+the project's.
+
 ```
 found principal-pi-skills@2.3.1 — 7 skill(s), 0 declaring allowed-tools
 wrote .pi/skills/decide/SKILL.md

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAyBH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAoCpD;AA4HD,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1D"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAyBH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,OAAO,CAAC;IACf,oFAAoF;IACpF,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAoCpD;AAkID,wBAAsB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1D"}

package/dist/cli.js

@@ -18,7 +18,7 @@ import { relative, resolve as resolvePath } from "node:path";
 import { pathToFileURL } from "node:url";
 import { UnsafeGrantError } from "./grant-env.js";
 import { applyInit, countDeclaring, planInit } from "./init.js";
-import { discoverSkillPackages } from "./skill-packages.js";
+import { discoverSkillPackages, skillPackageRoots } from "./skill-packages.js";
 const USAGE = `pi-daddy — capability governance for pi sub-agents
 
 Usage:
@@ -85,9 +85,15 @@ export function parseArgs(argv) {
 async function init(cwd, force) {
     const packages = await discoverSkillPackages(cwd);
     if (packages.length === 0) {
-        console.log(`pi-daddy init: no installed package under ${cwd}/node_modules declares skills\n` +
-            `(a package.json "pi": {"skills": [...]} field). Nothing to scaffold.\n\n` +
-            `  npm install principal-pi-skills   # seven skills; then re-run this`);
+        // Names BOTH roots it looked in, and offers pi's own install command first. The previous message named
+        // only `<cwd>/node_modules` and said "npm install …" — so an operator who had just run
+        // `pi install npm:principal-pi-skills`, which installs to the agent root, was told to install a package
+        // they had already installed (R-75).
+        console.log(`pi-daddy init: no installed package declares skills (a package.json "pi": {"skills": [...]} ` +
+            `field). Nothing to scaffold.\n\nLooked in:\n` +
+            skillPackageRoots(cwd).map((r) => `  ${r}\n`).join("") +
+            `\n  pi install npm:principal-pi-skills    # seven skills, and registers it with pi\n` +
+            `  npm install principal-pi-skills      # or pin it in this project instead`);
         return 0;
     }
     let plan;

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAiB,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAwC,MAAM,qBAAqB,CAAC;AAElG,MAAM,KAAK,GAAG;;;;;;;;;;;;;4FAa8E,CAAC;AAU7F;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;IACxF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE/G,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,oBAAoB,OAAO,GAAG,CAAC,EAAE,CAAC;IAE3G,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,kGAAkG;YAClG,mGAAmG;YACnG,8DAA8D;YAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;iBAC/E,CAAC;gBACJ,GAAG,GAAG,KAAK,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qGAAqG;YACrG,oGAAoG;YACpG,kGAAkG;YAClG,yFAAyF;YACzF,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAc;IAC7C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,6CAA6C,GAAG,iCAAiC;YAC/E,0EAA0E;YAC1E,sEAAsE,CACzE,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mGAAmG;QACnG,mGAAmG;QACnG,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CACT,SAAS,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,aAAa;YAClE,GAAG,SAAS,0BAA0B;YACtC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,MAAM,6BAA6B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,gGAAgG;YAChG,kDAAkD;YAClD,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IAE/E,sGAAsG;IACtG,yDAAyD;IACzD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,8BAA8B,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,uBAAuB;YACvG,oGAAoG,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC/G,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEvG,MAAM,CAAC,IAAI,CAAC,CAAC;IACb,qGAAqG;IACrG,qFAAqF;IACrF,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,GAAiB,EAAE,OAAqB;IAC7D,MAAM,IAAI,GAAG,WAAW,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,aAAa;YAChB,OAAO,CACL,GAAG,IAAI,uFAAuF;gBAC9F,8FAA8F,CAC/F,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO,CACL,GAAG,IAAI,aAAa,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;gBAC/F,8FAA8F;gBAC9F,oDAAoD,CACrD,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,GAAG,IAAI,aAAa,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;gBACpG,6DAA6D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,6CAA6C,IAAI;gBACxL,6DAA6D,CAC9D,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,6FAA6F,CAAC;IAChH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,IAAc;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEtE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,KAAK,UAAU,CAAC,MAAM,0EAA0E;YAC9F,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAChD,mGAAmG;YACnG,mGAAmG;YACnG,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,OAAO,CAAC,GAAG,CACT,0BAA0B,MAAM,KAAK;YACnC,iGAAiG;YACjG,kGAAkG,CACrG,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,CAAC,KAAK,CAAC,MAAM,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QAC9E,gEAAgE;QAChE,mFAAmF,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,wGAAwG;IACxG,yGAAyG;IACzG,0GAA0G;IAC1G,+EAA+E;IAC/E,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,IAAI,eAAe,EAAE,CAAC;IACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,QAAQ,EAAiB,MAAM,WAAW,CAAC;AAC/E,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAwC,MAAM,qBAAqB,CAAC;AAErH,MAAM,KAAK,GAAG;;;;;;;;;;;;;4FAa8E,CAAC;AAU7F;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAc;IACtC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC;IACxF,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IACzG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAE/G,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,OAAO,KAAK,MAAM;QAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,oBAAoB,OAAO,GAAG,CAAC,EAAE,CAAC;IAE3G,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,GAAuB,CAAC;IAC5B,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;aAAM,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC1B,kGAAkG;YAClG,mGAAmG;YACnG,8DAA8D;YAC9D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;iBAC/E,CAAC;gBACJ,GAAG,GAAG,KAAK,CAAC;gBACZ,CAAC,IAAI,CAAC,CAAC;YACT,CAAC;QACH,CAAC;aAAM,CAAC;YACN,qGAAqG;YACrG,oGAAoG;YACpG,kGAAkG;YAClG,yFAAyF;YACzF,MAAM,CAAC,IAAI,CAAC,kBAAkB,GAAG,EAAE,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,IAAI,CAAC,GAAW,EAAE,KAAc;IAC7C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,uGAAuG;QACvG,uFAAuF;QACvF,wGAAwG;QACxG,qCAAqC;QACrC,OAAO,CAAC,GAAG,CACT,8FAA8F;YAC5F,8CAA8C;YAC9C,iBAAiB,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,sFAAsF;YACtF,4EAA4E,CAC/E,CAAC;QACF,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mGAAmG;QACnG,mGAAmG;QACnG,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;YACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,CAAC;QACX,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5E,OAAO,CAAC,GAAG,CACT,SAAS,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,aAAa;YAClE,GAAG,SAAS,0BAA0B;YACtC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,UAAU,CAAC,MAAM,6BAA6B,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,gGAAgG;YAChG,kDAAkD;YAClD,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxF,KAAK,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,OAAO;QAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;IAE/E,sGAAsG;IACtG,yDAAyD;IACzD,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;QACpC,OAAO,CAAC,GAAG,CACT,8BAA8B,QAAQ,gBAAgB,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,uBAAuB;YACvG,oGAAoG,CACvG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACxE,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;IAC/G,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;IAEvG,MAAM,CAAC,IAAI,CAAC,CAAC;IACb,qGAAqG;IACrG,qFAAqF;IACrF,OAAO,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,iFAAiF;AACjF,SAAS,aAAa,CAAC,GAAiB,EAAE,OAAqB;IAC7D,MAAM,IAAI,GAAG,WAAW,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,QAAQ,OAAO,CAAC,MAAM,EAAE,CAAC;QACvB,KAAK,aAAa;YAChB,OAAO,CACL,GAAG,IAAI,uFAAuF;gBAC9F,8FAA8F,CAC/F,CAAC;QACJ,KAAK,mBAAmB;YACtB,OAAO,CACL,GAAG,IAAI,aAAa,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,kDAAkD;gBAC/F,8FAA8F;gBAC9F,oDAAoD,CACrD,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,CACL,GAAG,IAAI,aAAa,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;gBACpG,6DAA6D,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,6CAA6C,IAAI;gBACxL,6DAA6D,CAC9D,CAAC;QACJ,KAAK,UAAU;YACb,OAAO,GAAG,IAAI,6FAA6F,CAAC;IAChH,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,IAAc;IAC5B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,YAAY,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEtE,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ;QAAE,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,KAAK,IAAI,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEvG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CACT,KAAK,UAAU,CAAC,MAAM,0EAA0E;YAC9F,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;YAChD,mGAAmG;YACnG,mGAAmG;YACnG,uCAAuC,CAC1C,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvG,OAAO,CAAC,GAAG,CACT,0BAA0B,MAAM,KAAK;YACnC,iGAAiG;YACjG,kGAAkG,CACrG,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,CAAC,KAAK,CAAC,MAAM,mBAAmB,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;QAC9E,gEAAgE;QAChE,mFAAmF,CACtF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,IAAc;IACvC,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE/B,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACjC,iGAAiG;QACjG,6FAA6F;QAC7F,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACrB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACnB,OAAO,CAAC,CAAC;IACX,CAAC;IAED,wGAAwG;IACxG,yGAAyG;IACzG,0GAA0G;IAC1G,+EAA+E;IAC/E,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE;IAC5B,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACzG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,CAAC,EAAE,CAAC;AACL,IAAI,eAAe,EAAE,CAAC;IACpB,OAAO,CAAC,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC"}

package/dist/grant-store.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The grant for a directory, stored **outside** it.
+ *
+ * `PI_GRANTS_GRANT` is the propagation channel to children and stays exactly as it was — a parent writes
+ * it once per session and every child inherits it. What this adds is a second *source* for the root
+ * session's own grant, so an operator does not have to `source` a file and restart pi to be governed.
+ *
+ * **Outside the workspace, and that is the whole design.** A grant is a ceiling; a ceiling a governed child
+ * can rewrite is not a ceiling. `<cwd>/.pi/grants.env` is writable by any child holding `tool:write`, so
+ * storing the live grant there would let a child widen the *next* session's ceiling — ADR-0014's
+ * self-defeating case verbatim, which is why persisted approvals were moved out of the workspace in the
+ * first place. This reuses that pattern exactly: `$PI_CODING_AGENT_DIR/grants/<slug>-<hash>.json`, keyed by
+ * the directory, unwritable by a narrowed child because a narrowed child holds no write access to `$HOME`.
+ *
+ * **It does not defend against a child holding `bash`** (ADR-0012). Nothing here does.
+ *
+ * `.pi/grants.env` is still written by `init` and is still worth committing — it is the *reviewable record*
+ * of the decision, diffable in a PR. It is simply no longer the thing the enforcer reads.
+ */
+import type { Capability } from "./resolve.ts";
+/**
+ * Where this directory's grant lives.
+ *
+ * Slug plus a 64-bit hash, exactly as `approvalsPath` does it and for the same two reasons: the basename
+ * keeps the directory legible to a human reading it, and the hash is what makes it unambiguous, since two
+ * checkouts can share a basename.
+ */
+export declare function grantStorePath(cwd: string): string;
+/**
+ * Parse a store file's text into a grant, or null.
+ *
+ * Split out from the readers so the **one** validation lives in one place: both the sync and async paths
+ * must agree, and two parsers is how they come to disagree.
+ *
+ * Fails closed on every doubt — a malformed file grants nothing rather than something. The `cwd` check is
+ * R-27's: a file copied to another machine or another checkout describes a directory that is not this one,
+ * and honouring it would let a grant travel somewhere nobody authorised it for.
+ */
+export declare function parseGrantFile(text: string, cwd: string): Capability[] | null;
+/**
+ * Read this directory's stored grant, synchronously.
+ *
+ * **Sync on purpose, and this is the constraint that shapes the feature.** Whether `delegate` is registered
+ * at all is decided when the extension factory runs (S-5: a session without `tool:delegate` must not be
+ * offered the tool), and that is before any `await` is possible. An async read would resolve after the
+ * decision it exists to inform, so the store would silently fail to grant delegation — the exact class of
+ * defect R-38 and R-39 were.
+ */
+export declare function loadGrantSync(cwd: string): Capability[] | null;
+/** Async twin, for callers that already have one. Same parser, so they cannot disagree. */
+export declare function loadGrant(cwd: string): Promise<Capability[] | null>;
+export type SaveOutcome = "saved" | "failed" | "busy";
+/**
+ * Write this directory's grant.
+ *
+ * Locked with the same lock the ledger and the approval store use, for the same reason: two sessions in one
+ * directory running `/grants init` concurrently must not interleave. A lock this cannot take yields `busy`
+ * and changes nothing — the caller reports it and the operator retries, which is the honest outcome for a
+ * write that never looked at the file (R-68).
+ *
+ * `wx` on the temp file refuses to follow a pre-existing symlink, and `rename` is atomic within a
+ * filesystem, so a reader never sees a half-written grant. Both copied from `writeFileSafely`, deliberately
+ * — a second, subtly different atomic-write is how the two come to disagree about what "safe" meant.
+ */
+export declare function saveGrant(cwd: string, grant: Capability[]): Promise<SaveOutcome>;
+/** Remove this directory's stored grant. True when a file was there to remove. */
+export declare function clearGrant(cwd: string): Promise<boolean>;
+//# sourceMappingURL=grant-store.d.ts.map

package/dist/grant-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.d.ts","sourceRoot":"","sources":["../src/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAgB/C;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAIlD;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAW7E;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,EAAE,GAAG,IAAI,CAM9D;AAED,2FAA2F;AAC3F,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,CAMzE;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC,WAAW,CAAC,CAmBtF;AAED,kFAAkF;AAClF,wBAAsB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS9D"}

package/dist/grant-store.js

@@ -0,0 +1,142 @@
+/**
+ * The grant for a directory, stored **outside** it.
+ *
+ * `PI_GRANTS_GRANT` is the propagation channel to children and stays exactly as it was — a parent writes
+ * it once per session and every child inherits it. What this adds is a second *source* for the root
+ * session's own grant, so an operator does not have to `source` a file and restart pi to be governed.
+ *
+ * **Outside the workspace, and that is the whole design.** A grant is a ceiling; a ceiling a governed child
+ * can rewrite is not a ceiling. `<cwd>/.pi/grants.env` is writable by any child holding `tool:write`, so
+ * storing the live grant there would let a child widen the *next* session's ceiling — ADR-0014's
+ * self-defeating case verbatim, which is why persisted approvals were moved out of the workspace in the
+ * first place. This reuses that pattern exactly: `$PI_CODING_AGENT_DIR/grants/<slug>-<hash>.json`, keyed by
+ * the directory, unwritable by a narrowed child because a narrowed child holds no write access to `$HOME`.
+ *
+ * **It does not defend against a child holding `bash`** (ADR-0012). Nothing here does.
+ *
+ * `.pi/grants.env` is still written by `init` and is still worth committing — it is the *reviewable record*
+ * of the decision, diffable in a PR. It is simply no longer the thing the enforcer reads.
+ */
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { mkdir, readFile, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { withFileLock, LockTimeoutError } from "./file-lock.js";
+/** `$PI_CODING_AGENT_DIR`, or pi's default. Same resolution as the approval store. */
+function agentDir() {
+    return process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+}
+/**
+ * Where this directory's grant lives.
+ *
+ * Slug plus a 64-bit hash, exactly as `approvalsPath` does it and for the same two reasons: the basename
+ * keeps the directory legible to a human reading it, and the hash is what makes it unambiguous, since two
+ * checkouts can share a basename.
+ */
+export function grantStorePath(cwd) {
+    const slug = (basename(cwd) || "root").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
+    const hash = createHash("sha256").update(cwd, "utf8").digest("hex").slice(0, 16);
+    return join(agentDir(), "grants", `${slug}-${hash}.json`);
+}
+/**
+ * Parse a store file's text into a grant, or null.
+ *
+ * Split out from the readers so the **one** validation lives in one place: both the sync and async paths
+ * must agree, and two parsers is how they come to disagree.
+ *
+ * Fails closed on every doubt — a malformed file grants nothing rather than something. The `cwd` check is
+ * R-27's: a file copied to another machine or another checkout describes a directory that is not this one,
+ * and honouring it would let a grant travel somewhere nobody authorised it for.
+ */
+export function parseGrantFile(text, cwd) {
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.version !== 1)
+            return null;
+        if (parsed.cwd !== cwd)
+            return null;
+        if (!Array.isArray(parsed.grant))
+            return null;
+        if (!parsed.grant.every((c) => typeof c === "string" && c.length > 0))
+            return null;
+        return parsed.grant;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Read this directory's stored grant, synchronously.
+ *
+ * **Sync on purpose, and this is the constraint that shapes the feature.** Whether `delegate` is registered
+ * at all is decided when the extension factory runs (S-5: a session without `tool:delegate` must not be
+ * offered the tool), and that is before any `await` is possible. An async read would resolve after the
+ * decision it exists to inform, so the store would silently fail to grant delegation — the exact class of
+ * defect R-38 and R-39 were.
+ */
+export function loadGrantSync(cwd) {
+    try {
+        return parseGrantFile(readFileSync(grantStorePath(cwd), "utf8"), cwd);
+    }
+    catch {
+        return null;
+    }
+}
+/** Async twin, for callers that already have one. Same parser, so they cannot disagree. */
+export async function loadGrant(cwd) {
+    try {
+        return parseGrantFile(await readFile(grantStorePath(cwd), "utf8"), cwd);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Write this directory's grant.
+ *
+ * Locked with the same lock the ledger and the approval store use, for the same reason: two sessions in one
+ * directory running `/grants init` concurrently must not interleave. A lock this cannot take yields `busy`
+ * and changes nothing — the caller reports it and the operator retries, which is the honest outcome for a
+ * write that never looked at the file (R-68).
+ *
+ * `wx` on the temp file refuses to follow a pre-existing symlink, and `rename` is atomic within a
+ * filesystem, so a reader never sees a half-written grant. Both copied from `writeFileSafely`, deliberately
+ * — a second, subtly different atomic-write is how the two come to disagree about what "safe" meant.
+ */
+export async function saveGrant(cwd, grant) {
+    const path = grantStorePath(cwd);
+    const file = { version: 1, cwd, grant: [...grant].sort(), writtenAt: new Date().toISOString() };
+    try {
+        await mkdir(dirname(path), { recursive: true });
+        return await withFileLock(path, "grant store", async () => {
+            const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+            try {
+                await writeFile(temp, `${JSON.stringify(file, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+                await rename(temp, path);
+                return "saved";
+            }
+            catch {
+                await unlink(temp).catch(() => undefined);
+                return "failed";
+            }
+        });
+    }
+    catch (error) {
+        return error instanceof LockTimeoutError ? "busy" : "failed";
+    }
+}
+/** Remove this directory's stored grant. True when a file was there to remove. */
+export async function clearGrant(cwd) {
+    const path = grantStorePath(cwd);
+    try {
+        await readFile(path, "utf8");
+    }
+    catch {
+        return false;
+    }
+    await rm(path, { force: true }).catch(() => undefined);
+    return true;
+}
+//# sourceMappingURL=grant-store.js.map

package/dist/grant-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-store.js","sourceRoot":"","sources":["../src/grant-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAClF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAYhE,sFAAsF;AACtF,SAAS,QAAQ;IACf,OAAO,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,IAAI,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACnF,OAAO,MAAM,CAAC,KAAqB,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,MAAM,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAID;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,KAAmB;IAC9D,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IAC3G,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,OAAO,MAAM,YAAY,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE;YACxD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC;YAC1D,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9F,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBACzB,OAAO,OAAgB,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC1C,OAAO,QAAiB,CAAC;YAC3B,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/D,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,GAAW;IAC1C,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/skill-packages.d.ts

@@ -108,5 +108,21 @@ export declare function readSkillPackage(packageDir: string): Promise<SkillPacka
  * `node_modules`: a transitive skill package is not something an operator asked to install definitions
  * from, and scaffolding one into their project would be a surprise wearing a helpful face.
  */
+/**
+ * Every place a pi package can be installed, most specific first (R-75).
+ *
+ * **Two roots, because pi has two install paths and only one of them is `npm install`.** `pi install
+ * npm:principal-pi-skills` — the documented, pi-native way, and the only one that registers the package so
+ * pi will auto-load its extension — puts it in `$PI_CODING_AGENT_DIR/npm/node_modules`, and leaves the
+ * project without a `node_modules` at all. Searching only `<cwd>/node_modules` therefore found **nothing**
+ * for an operator who followed pi's own instructions, and said "install principal-pi-skills" to somebody
+ * who just had.
+ *
+ * Measured, in a fresh `PI_CODING_AGENT_DIR` with an empty project: `pi install` populates the agent root
+ * and creates no project root.
+ *
+ * Project first when both exist, because a package pinned in the repository is the one the team agreed on.
+ */
+export declare function skillPackageRoots(cwd: string): string[];
 export declare function discoverSkillPackages(cwd: string): Promise<SkillPackage[]>;
 //# sourceMappingURL=skill-packages.d.ts.map

package/dist/skill-packages.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packages.d.ts","sourceRoot":"","sources":["../src/skill-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAIH,OAAO,EAA8C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpG,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,2GAA2G;IAC3G,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa;AACvB,uFAAuF;AACrF,aAAa;AACf,yFAAyF;GACvF,mBAAmB;AACrB,yGAAyG;GACvG,UAAU;AACZ,iFAAiF;GAC/E,UAAU,CAAC;AAEf,MAAM,WAAW,YAAY;IAC3B,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uGAAuG;IACvG,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAMxD;AA2DD,2GAA2G;AAC3G,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAkCvF;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CA6BhF"}
+{"version":3,"file":"skill-packages.d.ts","sourceRoot":"","sources":["../src/skill-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAKH,OAAO,EAA8C,KAAK,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEpG,OAAO,EAAkB,KAAK,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/D,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,eAAe,CAAC;IAC5B,2GAA2G;IAC3G,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,6FAA6F;AAC7F,MAAM,MAAM,aAAa;AACvB,uFAAuF;AACrF,aAAa;AACf,yFAAyF;GACvF,mBAAmB;AACrB,yGAAyG;GACvG,UAAU;AACZ,iFAAiF;GAC/E,UAAU,CAAC;AAEf,MAAM,WAAW,YAAY;IAC3B,uFAAuF;IACvF,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,CAAC;IACtB,sDAAsD;IACtD,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,yGAAyG;IACzG,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,uGAAuG;IACvG,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,MAAM,EAAE,eAAe,EAAE,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEhD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,UAAU,GAAG,OAAO,CAMxD;AA2DD,2GAA2G;AAC3G,wBAAsB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAkCvF;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAGvD;AAED,wBAAsB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAgBhF"}

package/dist/skill-packages.js

@@ -25,6 +25,7 @@
  * `source`s; the only strings that may reach it are ones that survived a whitelist here.
  */
 import { readdir, readFile, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { ceilingForDefinition, parseSkillDefinition } from "./definitions.js";
 import { WILDCARD } from "./pi-tools.js";
@@ -179,16 +180,51 @@ export async function readSkillPackage(packageDir) {
  * `node_modules`: a transitive skill package is not something an operator asked to install definitions
  * from, and scaffolding one into their project would be a surprise wearing a helpful face.
  */
+/**
+ * Every place a pi package can be installed, most specific first (R-75).
+ *
+ * **Two roots, because pi has two install paths and only one of them is `npm install`.** `pi install
+ * npm:principal-pi-skills` — the documented, pi-native way, and the only one that registers the package so
+ * pi will auto-load its extension — puts it in `$PI_CODING_AGENT_DIR/npm/node_modules`, and leaves the
+ * project without a `node_modules` at all. Searching only `<cwd>/node_modules` therefore found **nothing**
+ * for an operator who followed pi's own instructions, and said "install principal-pi-skills" to somebody
+ * who just had.
+ *
+ * Measured, in a fresh `PI_CODING_AGENT_DIR` with an empty project: `pi install` populates the agent root
+ * and creates no project root.
+ *
+ * Project first when both exist, because a package pinned in the repository is the one the team agreed on.
+ */
+export function skillPackageRoots(cwd) {
+    const agentDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+    return [join(cwd, "node_modules"), join(agentDir, "npm", "node_modules")];
+}
 export async function discoverSkillPackages(cwd) {
-    const root = join(cwd, "node_modules");
+    const dirs = [];
+    const seenNames = new Set();
+    for (const root of skillPackageRoots(cwd))
+        await collectFrom(root, dirs);
+    const packages = [];
+    for (const dir of dirs) {
+        const found = await readSkillPackage(dir);
+        // First root wins on a name collision: the project's pinned copy outranks the machine-wide one, and
+        // silently preferring the other would make a committed lockfile stop meaning anything.
+        if (found && !seenNames.has(found.name)) {
+            seenNames.add(found.name);
+            packages.push(found);
+        }
+    }
+    return packages.sort((a, b) => a.name.localeCompare(b.name));
+}
+/** Append every package directory under one `node_modules`, scoped packages included. */
+async function collectFrom(root, dirs) {
     let entries;
     try {
         entries = await readdir(root);
     }
     catch {
-        return []; // no node_modules is a normal state, not a failure
+        return; // a root that does not exist is a normal state, not a failure
     }
-    const dirs = [];
     for (const entry of entries.sort()) {
         if (entry.startsWith("."))
             continue; // .bin, .package-lock.json
@@ -205,12 +241,5 @@ export async function discoverSkillPackages(cwd) {
             dirs.push(join(root, entry));
         }
     }
-    const packages = [];
-    for (const dir of dirs) {
-        const found = await readSkillPackage(dir);
-        if (found)
-            packages.push(found);
-    }
-    return packages.sort((a, b) => a.name.localeCompare(b.name));
 }
 //# sourceMappingURL=skill-packages.js.map

package/dist/skill-packages.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-packages.js","sourceRoot":"","sources":["../src/skill-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAwB,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAsC/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAc;IAC7C,MAAM,OAAO,GAAG,4BAA4B,CAAC;IAC7C,OAAO,CACL,IAAI,MAAM,CAAC,uBAAuB,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,UAAU,OAAO,MAAM,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,WAAW,CAAC,YAA0B;IAC7C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAsB;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAEvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1F,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC1C,yGAAyG;IACzG,oGAAoG;IACpG,yGAAyG;IACzG,0GAA0G;IAC1G,yGAAyG;IACzG,mDAAmD;IACnD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3F,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5D,oGAAoG;QACpG,yGAAyG;QACzG,8EAA8E;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAEhE,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,IAAI,QAAwE,CAAC;IAC7E,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,WAAW;QACjE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,cAAc;QAC3C,UAAU;QACV,OAAO;QACP,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACvC,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,mDAAmD;IAChE,CAAC;IAED,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,2BAA2B;QAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,IAAI,KAAK;YAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC"}
+{"version":3,"file":"skill-packages.js","sourceRoot":"","sources":["../src/skill-packages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,oBAAoB,EAAE,oBAAoB,EAAwB,MAAM,kBAAkB,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAmB,MAAM,cAAc,CAAC;AAsC/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAAc;IAC7C,MAAM,OAAO,GAAG,4BAA4B,CAAC;IAC7C,OAAO,CACL,IAAI,MAAM,CAAC,uBAAuB,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,MAAM,CAAC,UAAU,OAAO,MAAM,OAAO,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAClE,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAS,WAAW,CAAC,YAA0B;IAC7C,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,cAAc,CAAC,CAAC;AAC5E,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CAAC,KAAsB;IACxC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;IAEvF,MAAM,OAAO,GAAG,oBAAoB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAE1F,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE7F,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8GAA8G;AAC9G,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC1C,yGAAyG;IACzG,oGAAoG;IACpG,yGAAyG;IACzG,0GAA0G;IAC1G,yGAAyG;IACzG,mDAAmD;IACnD,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAC3F,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAE5D,oGAAoG;QACpG,yGAAyG;QACzG,8EAA8E;QAC9E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,UAAU,CAAC;QAEhE,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACpD,OAAO,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2GAA2G;AAC3G,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAkB;IACvD,IAAI,QAAwE,CAAC;IAC7E,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnE,MAAM,MAAM,GAAsB,EAAE,CAAC;IACrC,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACN,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;;gBAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,WAAW;QACjE,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,cAAc;QAC3C,UAAU;QACV,OAAO;QACP,MAAM;KACP,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IACpF,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,GAAW;IACrD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,GAAG,CAAC;QAAE,MAAM,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAEzE,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC1C,oGAAoG;QACpG,uFAAuF;QACvF,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACxC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,yFAAyF;AACzF,KAAK,UAAU,WAAW,CAAC,IAAY,EAAE,IAAc;IACrD,IAAI,OAAiB,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,8DAA8D;IACxE,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACnC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS,CAAC,2BAA2B;QAChE,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACH,KAAK,MAAM,MAAM,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;oBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;AACH,CAAC"}

package/extensions/grants-command.ts

@@ -43,6 +43,15 @@ export interface GrantsCommandContext {
    * R-28 discipline where it belongs: this command asks what would happen instead of working it out.
    */
   previewDelegation: (name: string) => Promise<GatedPlan>;
+  /**
+   * Run `/grants init`: scaffold definitions, ask about the withheld capabilities only, store the answer
+   * outside the workspace, and apply it to this session (ADR-0030).
+   *
+   * Injected rather than imported so this module stays what it is — a read-only diagnostic that cannot
+   * become a governance path by accident. The one command here that *writes* takes its ability to do so
+   * from the caller, visibly.
+   */
+  runInit: () => Promise<void>;
 }
 
 /**
@@ -51,6 +60,9 @@ export interface GrantsCommandContext {
  */
 const PREVIEW_LIMIT = 12;
 
+/** The verbs `/grants` answers to. Anything else is refused rather than silently treated as no verb. */
+const KNOWN_SUBCOMMANDS: readonly string[] = ["init", "ledger", "approvals", "revoke"];
+
 export const grantsCommand = {
   description:
     "Show this session's capability grant, delegation depth, and known agent-type ceilings; " +
@@ -65,6 +77,11 @@ handler: async (args: string, ctx: any) => {
 
     const [sub, target] = args.trim().split(/\s+/).filter(Boolean);
 
+    if (sub === "init") {
+      await ctx.grants.runInit();
+      return;
+    }
+
     if (sub === "ledger") {
       // The detector, made reachable. `verifyLedger` exists because nothing in this package had ever read
       // a ledger back, so a torn line was indistinguishable from a spawn that never happened — and a
@@ -265,6 +282,20 @@ handler: async (args: string, ctx: any) => {
       return;
     }
 
+    // **An unrecognised subcommand is refused, not ignored (R-74).** Every `sub` that is not a known verb
+    // fell through to this status screen with the word silently dropped, so `/grants init` — a command that
+    // does not exist — printed a healthy-looking report and read as though it had run. `/grants ledgr` did
+    // the same. A diagnostic that answers a question nobody asked is worse than one that refuses: it is
+    // indistinguishable from success, which is the shape this package spends most of its risk register on.
+    if (sub !== undefined && !KNOWN_SUBCOMMANDS.includes(sub)) {
+      ctx.ui.notify(
+        `grants: unknown subcommand "${sub}" — did nothing. Known: ${KNOWN_SUBCOMMANDS.join(", ")}. ` +
+          `Plain /grants shows this session's status.`,
+        "warning",
+      );
+      return;
+    }
+
     const { valid } = await loadApprovals({ cwd, now: new Date(), snapshotOf });
     const lines = [
       governed ? "grants: ACTIVE" : "grants: inactive (set PI_GRANTS_GRANT to govern this session)",

package/extensions/grants.ts

@@ -30,12 +30,16 @@ import { legacyApprovalsPath, sharedApprovalsPath } from "../src/approval-store.
 import { buildCatalog } from "../src/catalog.ts";
 import { loadDefinitions } from "../src/definitions.ts";
 import { appendRecord, buildRecord, verifyLedger } from "../src/ledger.ts";
-import { deriveOwnGrant, observeToolNames } from "../src/propagation.ts";
+import {
+  ENV_GRANT, deriveOwnGrant, observeToolNames } from "../src/propagation.ts";
 import { snapshotOf } from "./approvals.ts";
 import { registerDelegationTools } from "./delegation.ts";
 import { grantsCommand } from "./grants-command.ts";
+import { runInit } from "./init-command.ts";
+import type { Capability } from "../src/resolve.ts";
+
 import { planWithApprovals } from "./run-delegation.ts";
-import { createGrantsSession } from "./session.ts";
+import { createGrantsSession, loadProjectDefinitions, type GrantsSession } from "./session.ts";
 import { renderSpawnableSummary, summariseSpawnable } from "./spawn-summary.ts";
 
 const SPAWN_TOOLS = new Set(["Agent", "subagent", "spawn_agent"]);
@@ -60,6 +64,20 @@ export default function (pi: ExtensionAPI) {
 
   pi.on("session_start", async (_event, ctx) => {
     session.cwd = ctx.cwd;
+    // The one case the stored-grant lookup can get wrong (ADR-0030). The factory reads the store keyed by
+    // `process.cwd()` because it runs before any hook and therefore before `ctx` exists — and S-5 forces
+    // that ordering, since whether `delegate` is registered is decided there. Almost always the two agree.
+    // When they do not, the session is governed by a different directory's decision than the one it is
+    // working in, which is exactly the confusion a grant must never cause, so it is said out loud rather
+    // than left to be inferred from a surprising refusal. Sync, so it is not the R-60 shape.
+    if (session.storeCwd !== ctx.cwd && process.env[ENV_GRANT] === undefined) {
+      ctx.ui.notify(
+        `grants: this session's stored grant was read for ${session.storeCwd}, but pi is working in ` +
+          `${ctx.cwd}. A grant belongs to a directory, so run /grants init here, or set PI_GRANTS_GRANT ` +
+          `explicitly — the environment always wins.`,
+        "warning",
+      );
+    }
     try {
       // Guarded together, and guarded at all because of R-60 rather than because either one throws today:
       // both loaders swallow their own filesystem errors, so this catch is currently unreachable. The point
@@ -69,9 +87,7 @@ export default function (pi: ExtensionAPI) {
       // delegate by `tools:`, and an operator whose `agent:` spawns have all started failing deserves to
       // know it was the *scan* that broke rather than the grant.
       try {
-        session.definitions = await loadDefinitions(ctx.cwd);
-        session.catalogReady = buildCatalog({ cwd: ctx.cwd, observedTools: session.observedTools });
-        session.catalog = await session.catalogReady;
+        await loadProjectDefinitions(session, ctx.cwd);
       } catch (error) {
         ctx.ui.notify(
           `grants: could not read this project's definitions or capability catalog ` +
@@ -368,9 +384,15 @@ export default function (pi: ExtensionAPI) {
           // says so: stored approvals count exactly as they would for a spawn, and no human is asked
           // (R-38). Passing `ctx` here would let `/grants` raise a dialog, and passing `hasUI: false` would
           // make every gated definition report "no interactive user" instead of what actually blocks it.
+          runInit: () =>
+            runInit(session, ctx, async () => {
+              await loadProjectDefinitions(session, ctx.cwd);
+              delegation.refreshSpawnable();
+            }),
           previewDelegation: (name: string) =>
             planWithApprovals(session, { task: "(preview)", agent: name }, {}, null),
         },
       }),
   });
 }
+

package/extensions/init-command.ts

@@ -0,0 +1,132 @@
+/**
+ * `/grants init` — the one command in this package that writes.
+ *
+ * Split out of `extensions/grants.ts` when the file-size guard refused it, and the seam is the right one:
+ * `grants.ts` is wiring, and this is a decision procedure that asks a human questions and stores the
+ * answer. Keeping it here means the file that registers hooks stays readable, which is the property the
+ * guard exists to defend — every wiring bug this package has had lived in that file.
+ */
+
+import { discoverSkillPackages } from "../src/skill-packages.ts";
+import { applyInit, planInit } from "../src/init.ts";
+import { saveGrant, grantStorePath } from "../src/grant-store.ts";
+import { expandSubsumed, SUBSUMPTION, type Capability } from "../src/resolve.ts";
+import type { GrantsSession } from "./session.ts";
+
+/**
+ * `/grants init` — scaffold, ask about what is withheld, store it outside the workspace, apply it now.
+ *
+ * **The dialog covers the withheld capabilities and nothing else** (ADR-0030). Asking about all of them
+ * would be a dozen questions for a first run, and this project has a name for what that produces: R-25,
+ * where the operator learns to click through and the control becomes decorative. The read-only capabilities
+ * a skill declares are already bounded by the ceiling its author wrote and by pi's `--tools`; the ones that
+ * can change the machine are the decision, so they are the question.
+ *
+ * A refusal is not a failure. Answering *no* to `tool:bash` leaves four definitions unspawnable and says so
+ * — that is the same outcome `pi-daddy init` writes by default, reached deliberately rather than by
+ * omission.
+ */
+export async function runInit(
+  session: GrantsSession,
+  ctx: any,
+  /**
+   * Reload definitions and the catalog, and re-describe the delegation tools.
+   *
+   * **Without this the grant goes live and the definitions do not** — `session.definitions` and the catalog
+   * are read at `session_start`, which is before `init` wrote a single file, so a session would hold
+   * `agent:review` while believing no definition of that name exists. `/grants` showed `0 skill,
+   * 0 agent-type` and no verdicts, and the model would have been told `Available: none` — R-39 exactly,
+   * reintroduced by a feature whose whole selling point is "no restart". Found by running it.
+   */
+  refresh: () => Promise<void>,
+): Promise<void> {
+  const packages = await discoverSkillPackages(ctx.cwd);
+  if (packages.length === 0) {
+    ctx.ui.notify(
+      "grants: no packages declaring skills found in node_modules. Install one — e.g. " +
+        "`npm i principal-pi-skills` — then run /grants init again.",
+      "warning",
+    );
+    return;
+  }
+
+  const plan = planInit(packages, ctx.cwd);
+  const outcome = await applyInit(plan);
+  const lines = [
+    `grants: ${plan.skills.length} definition(s) from ${packages.map((p) => `${p.name}@${p.version}`).join(", ")}`,
+    `  wrote ${outcome.written.length}, kept ${outcome.kept.length} already present` +
+      `${outcome.failed.length > 0 ? `, ${outcome.failed.length} FAILED` : ""}`,
+  ];
+  for (const f of outcome.failed) lines.push(`    ${f.path}: ${f.error}`);
+
+  // The grant `init` would have written to `.pi/grants.env`: read-only, nothing that can change the
+  // machine. Everything below is added to it only by an explicit yes.
+  const grant = new Set<Capability>(plan.grant);
+  const granted: string[] = [];
+  const declined: string[] = [];
+  /** Withheld capabilities a previous *yes* already conferred, so no question was asked about them. */
+  const alreadyConferred: string[] = [];
+
+  for (const [capability, neededBy] of plan.withheldCapabilities) {
+    // **Do not ask a question whose answer cannot matter.** `tool:bash` subsumes `write`, `edit` and
+    // `edit-diff` (`SUBSUMPTION`, `src/resolve.ts`), so once bash is granted those are already conferred.
+    // The first version asked anyway: an operator could answer *no* to `tool:write`, watch `/grants` allow
+    // `build` with `tool:write`, and reasonably conclude the dialog was decorative. It was — that is R-47's
+    // shape, a control that appears to do something and does not, inside a control built to prevent it.
+    //
+    // Reported rather than silently skipped, because "you already granted this" is the useful sentence and
+    // silence is what made it confusing.
+    if (expandSubsumed([...grant]).includes(capability)) {
+      alreadyConferred.push(`${capability} (via ${subsumedBy([...grant], capability) ?? "a granted capability"})`);
+      for (const name of neededBy) grant.add(`agent:${name}` as Capability);
+      continue;
+    }
+    const answer = await ctx.ui.select(
+      `grants: grant ${capability} to sub-agents?\n  needed by: ${neededBy.join(", ")}\n` +
+        `  this can change your machine — ${capability === "tool:bash" ? "and bash also confers write and edit" : "it is not gated, so no dialog at spawn time"}`,
+      ["No", "Yes"],
+    );
+    if (answer === "Yes") {
+      grant.add(capability);
+      granted.push(capability);
+      // The `agent:` ids too: a definition authorised but unable to receive what it declares would be
+      // allowed to run and then refused, which is a worse answer than not being authorised (ADR-0029).
+      for (const name of neededBy) grant.add(`agent:${name}` as Capability);
+    } else {
+      declined.push(`${capability} (${neededBy.join(", ")})`);
+    }
+  }
+
+  const finalGrant = [...grant].sort();
+  const saved = await saveGrant(ctx.cwd, finalGrant);
+  if (saved !== "saved") {
+    lines.push(
+      `  NOT STORED — ${saved === "busy" ? "another session holds the grant store" : "the store could not be written"}. ` +
+        `Nothing was changed; this session's grant is unchanged. Retry, or export PI_GRANTS_GRANT yourself.`,
+    );
+    ctx.ui.notify(lines.join("\n"), "error");
+    return;
+  }
+
+  // Live, without a restart — the whole point of the store. Only after a successful write, so what runs and
+  // what is recorded cannot disagree.
+  session.adoptGrant(finalGrant);
+  // Order matters: the grant first, then the reload, because `refreshSpawnable` filters the definitions it
+  // advertises through `maySpawnDefinition` against the grant the session now holds.
+  await refresh();
+
+  lines.push(`  stored at ${grantStorePath(ctx.cwd)} — outside this project, so no child can rewrite it`);
+  if (granted.length > 0) lines.push(`  GRANTED: ${granted.join(", ")}`);
+  if (alreadyConferred.length > 0) {
+    lines.push(`  ALREADY CONFERRED, not asked about: ${alreadyConferred.join(", ")}`);
+  }
+  if (declined.length > 0) lines.push(`  withheld: ${declined.join("; ")}`);
+  lines.push(`  live now (${finalGrant.length} capabilities) — no restart. /grants shows the verdicts.`);
+  ctx.ui.notify(lines.join("\n"), "info");
+}
+
+/** Which held capability confers `capability`, for a message that names the cause rather than the effect. */
+function subsumedBy(held: Capability[], capability: Capability): Capability | null {
+  for (const h of held) if ((SUBSUMPTION[h] ?? []).includes(capability)) return h;
+  return null;
+}

package/extensions/session.ts

@@ -37,6 +37,9 @@ import {
   parseList,
 } from "../src/propagation.ts";
 import type { Capability } from "../src/resolve.ts";
+import { loadDefinitions } from "../src/definitions.ts";
+import { buildCatalog } from "../src/catalog.ts";
+import { loadGrantSync, grantStorePath } from "../src/grant-store.ts";
 import { republishable } from "./approvals.ts";
 
 /**
@@ -54,8 +57,17 @@ export const ENV_HERDR_WORKSPACE = "PI_GRANTS_HERDR_WORKSPACE";
 export const ENV_HERDR_KEEP_PANE = "PI_GRANTS_HERDR_KEEP_PANE";
 
 export interface GrantsSession {
-  /** False when `PI_GRANTS_GRANT` is unset: the session holds the wildcard and nothing is governed. */
-  readonly governed: boolean;
+  /**
+   * False when neither `PI_GRANTS_GRANT` nor a stored grant applies: the session holds the wildcard and
+   * nothing is governed.
+   *
+   * **Mutable, because `/grants init` makes an ungoverned session governed mid-run.** The first version of
+   * ADR-0030 left this readonly on the reasoning that a store is read at creation and `init` only runs where
+   * one exists — which is false for the first `init` in a directory, the most common case there is. The
+   * session then bounded every spawn by the new grant while `/grants` reported "inactive", so the status
+   * line contradicted the enforcer. Found by running it.
+   */
+  governed: boolean;
   /** The upper bound handed down by the delegator, before this session's own tools are observed. */
   readonly inherited: Capability[];
   readonly depth: number;
@@ -129,6 +141,23 @@ export interface GrantsSession {
    * prompted the human. A value scoped to one specific child is never written to this global channel.
    */
   publishChildEnv(): void;
+  /**
+   * The directory whose stored grant this session read, or would read. `process.cwd()` — see the note in
+   * `createGrantsSession` for why the factory cannot use `ctx.cwd`.
+   */
+  readonly storeCwd: string;
+  /**
+   * Adopt a grant decided DURING the session — `/grants init` answering a human — without a restart.
+   *
+   * Narrow by design: it sets the session's own grant and republishes, so the very next spawn is bounded by
+   * it. It does **not** reach children that already exist; those are separate processes whose environment
+   * was fixed when they started, and reaching into them is neither possible nor desirable — a child's
+   * ceiling should not move under it mid-run.
+   *
+   * Only a human can reach this. Slash commands are user-invoked; no tool exposes it, so a model cannot
+   * widen its own session's ceiling by calling something.
+   */
+  adoptGrant(grant: Capability[]): void;
 }
 
 /**
@@ -138,12 +167,40 @@ export interface GrantsSession {
  * extension**, so a child granted `tool:delegate` can be started with `-e <that file>`. `grants.ts` is that
  * file, and only `grants.ts` can say so about itself.
  */
+/**
+ * Load this project's definitions and capability catalog into the session.
+ *
+ * **One loader, two callers.** `session_start` runs it, and so does `/grants init` — which writes the very
+ * files it reads, so a session that skipped this held `agent:review` while believing no definition of that
+ * name existed, and the model was told `Available: none` (R-39's shape, reintroduced by the feature whose
+ * selling point is "no restart"). Two copies of these three steps is how the two callers come to disagree
+ * about what loading means, so there is one.
+ */
+export async function loadProjectDefinitions(session: GrantsSession, cwd: string): Promise<void> {
+  session.definitions = await loadDefinitions(cwd);
+  session.catalogReady = buildCatalog({ cwd, observedTools: session.observedTools });
+  session.catalog = await session.catalogReady;
+}
+
 export function createGrantsSession(extensionPath: string | undefined): GrantsSession {
-  // Governance is opt-in: with PI_GRANTS_GRANT unset the session holds the wildcard and nothing is
-  // blocked. This extension must never silently tighten a normal workflow.
+  // Governance is opt-in: with PI_GRANTS_GRANT unset AND no stored grant for this directory, the session
+  // holds the wildcard and nothing is blocked. This extension must never silently tighten a normal
+  // workflow.
+  //
+  // **Two sources, and the environment always wins** (ADR-0030). The variable is how a CHILD is governed
+  // and how CI is configured, so a store that could override it would let a directory quietly widen or
+  // narrow a child its parent had already bounded. The store is consulted only when the variable is absent,
+  // which is exactly the case it was added for: a human at a terminal who ran `/grants init` here.
+  //
+  // `process.cwd()` rather than `ctx.cwd`, because this runs in the extension factory — before any hook,
+  // and therefore before `ctx` exists. That ordering is forced by S-5: whether `delegate` is registered at
+  // all is decided here, and a grant arriving later could not inform it. `session_start` re-checks the two
+  // against each other and says so if they differ, which is the only case this can get wrong.
   const grantRaw = process.env[ENV_GRANT];
-  const governed = grantRaw !== undefined;
-  const inherited: Capability[] = governed ? parseList(grantRaw) : [WILDCARD];
+  const storeCwd = process.cwd();
+  const stored = grantRaw === undefined ? loadGrantSync(storeCwd) : null;
+  const governed = grantRaw !== undefined || stored !== null;
+  const inherited: Capability[] = grantRaw !== undefined ? parseList(grantRaw) : (stored ?? [WILDCARD]);
   // G7 / A-S4 + B-I4: strict, three-way parsing that fails CLOSED. A malformed bound used to yield
   // `NaN`, and every comparison against `NaN` is false, so depth limiting switched itself off.
   const bounds = depthConfig(process.env[ENV_DEPTH], process.env[ENV_MAX_DEPTH]);
@@ -214,6 +271,18 @@ export function createGrantsSession(extensionPath: string | undefined): GrantsSe
       ...(approved ? { approved } : {}),
     }),
 
+    storeCwd,
+
+    adoptGrant: (grant: Capability[]) => {
+      // Governed too, not just bounded. A session that starts with no grant and then runs `/grants init` is
+      // governed from that moment: every spawn is bounded by what was just stored. Leaving this false made
+      // `/grants` print "inactive" while holding thirteen capabilities — a status line contradicting the
+      // enforcer, which is the defect R-28 is named for.
+      session.governed = true;
+      session.ownGrant = grant;
+      session.publishChildEnv();
+    },
+
     publishChildEnv: () => {
       const env = childEnv({
         ownGrant: session.ownGrant,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-daddy",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Capability governance for pi sub-agents: spawn Agent Skills (SKILL.md) definitions whose allowed-tools becomes a grant that can only narrow going down a delegation tree, enforced by pi's own --tools allowlist, with an append-only ledger.",
   "keywords": [
     "pi-package",

package/src/cli.ts

@@ -19,7 +19,7 @@ import { relative, resolve as resolvePath } from "node:path";
 import { pathToFileURL } from "node:url";
 import { UnsafeGrantError } from "./grant-env.ts";
 import { applyInit, countDeclaring, planInit, type InitPlan } from "./init.ts";
-import { discoverSkillPackages, type RefusedSkill, type SkillPackage } from "./skill-packages.ts";
+import { discoverSkillPackages, skillPackageRoots, type RefusedSkill, type SkillPackage } from "./skill-packages.ts";
 
 const USAGE = `pi-daddy — capability governance for pi sub-agents
 
@@ -93,10 +93,16 @@ export function parseArgs(argv: string[]): ParsedArgs {
 async function init(cwd: string, force: boolean): Promise<number> {
   const packages = await discoverSkillPackages(cwd);
   if (packages.length === 0) {
+    // Names BOTH roots it looked in, and offers pi's own install command first. The previous message named
+    // only `<cwd>/node_modules` and said "npm install …" — so an operator who had just run
+    // `pi install npm:principal-pi-skills`, which installs to the agent root, was told to install a package
+    // they had already installed (R-75).
     console.log(
-      `pi-daddy init: no installed package under ${cwd}/node_modules declares skills\n` +
-        `(a package.json "pi": {"skills": [...]} field). Nothing to scaffold.\n\n` +
-        `  npm install principal-pi-skills   # seven skills; then re-run this`,
+      `pi-daddy init: no installed package declares skills (a package.json "pi": {"skills": [...]} ` +
+        `field). Nothing to scaffold.\n\nLooked in:\n` +
+        skillPackageRoots(cwd).map((r) => `  ${r}\n`).join("") +
+        `\n  pi install npm:principal-pi-skills    # seven skills, and registers it with pi\n` +
+        `  npm install principal-pi-skills      # or pin it in this project instead`,
     );
     return 0;
   }

package/src/grant-store.ts

@@ -0,0 +1,151 @@
+/**
+ * The grant for a directory, stored **outside** it.
+ *
+ * `PI_GRANTS_GRANT` is the propagation channel to children and stays exactly as it was — a parent writes
+ * it once per session and every child inherits it. What this adds is a second *source* for the root
+ * session's own grant, so an operator does not have to `source` a file and restart pi to be governed.
+ *
+ * **Outside the workspace, and that is the whole design.** A grant is a ceiling; a ceiling a governed child
+ * can rewrite is not a ceiling. `<cwd>/.pi/grants.env` is writable by any child holding `tool:write`, so
+ * storing the live grant there would let a child widen the *next* session's ceiling — ADR-0014's
+ * self-defeating case verbatim, which is why persisted approvals were moved out of the workspace in the
+ * first place. This reuses that pattern exactly: `$PI_CODING_AGENT_DIR/grants/<slug>-<hash>.json`, keyed by
+ * the directory, unwritable by a narrowed child because a narrowed child holds no write access to `$HOME`.
+ *
+ * **It does not defend against a child holding `bash`** (ADR-0012). Nothing here does.
+ *
+ * `.pi/grants.env` is still written by `init` and is still worth committing — it is the *reviewable record*
+ * of the decision, diffable in a PR. It is simply no longer the thing the enforcer reads.
+ */
+
+import { createHash } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { mkdir, readFile, rename, rm, unlink, writeFile } from "node:fs/promises";
+import { randomUUID } from "node:crypto";
+import { homedir } from "node:os";
+import { basename, dirname, join } from "node:path";
+import { withFileLock, LockTimeoutError } from "./file-lock.ts";
+import type { Capability } from "./resolve.ts";
+
+interface GrantFile {
+  version: 1;
+  /** The directory this grant is for. Checked on read — an entry copied elsewhere is refused (R-27). */
+  cwd: string;
+  grant: Capability[];
+  /** When `/grants init` wrote it. Informational; nothing expires. */
+  writtenAt: string;
+}
+
+/** `$PI_CODING_AGENT_DIR`, or pi's default. Same resolution as the approval store. */
+function agentDir(): string {
+  return process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+}
+
+/**
+ * Where this directory's grant lives.
+ *
+ * Slug plus a 64-bit hash, exactly as `approvalsPath` does it and for the same two reasons: the basename
+ * keeps the directory legible to a human reading it, and the hash is what makes it unambiguous, since two
+ * checkouts can share a basename.
+ */
+export function grantStorePath(cwd: string): string {
+  const slug = (basename(cwd) || "root").replace(/[^A-Za-z0-9._-]/g, "_").slice(0, 40);
+  const hash = createHash("sha256").update(cwd, "utf8").digest("hex").slice(0, 16);
+  return join(agentDir(), "grants", `${slug}-${hash}.json`);
+}
+
+/**
+ * Parse a store file's text into a grant, or null.
+ *
+ * Split out from the readers so the **one** validation lives in one place: both the sync and async paths
+ * must agree, and two parsers is how they come to disagree.
+ *
+ * Fails closed on every doubt — a malformed file grants nothing rather than something. The `cwd` check is
+ * R-27's: a file copied to another machine or another checkout describes a directory that is not this one,
+ * and honouring it would let a grant travel somewhere nobody authorised it for.
+ */
+export function parseGrantFile(text: string, cwd: string): Capability[] | null {
+  try {
+    const parsed = JSON.parse(text) as Partial<GrantFile>;
+    if (parsed.version !== 1) return null;
+    if (parsed.cwd !== cwd) return null;
+    if (!Array.isArray(parsed.grant)) return null;
+    if (!parsed.grant.every((c) => typeof c === "string" && c.length > 0)) return null;
+    return parsed.grant as Capability[];
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Read this directory's stored grant, synchronously.
+ *
+ * **Sync on purpose, and this is the constraint that shapes the feature.** Whether `delegate` is registered
+ * at all is decided when the extension factory runs (S-5: a session without `tool:delegate` must not be
+ * offered the tool), and that is before any `await` is possible. An async read would resolve after the
+ * decision it exists to inform, so the store would silently fail to grant delegation — the exact class of
+ * defect R-38 and R-39 were.
+ */
+export function loadGrantSync(cwd: string): Capability[] | null {
+  try {
+    return parseGrantFile(readFileSync(grantStorePath(cwd), "utf8"), cwd);
+  } catch {
+    return null;
+  }
+}
+
+/** Async twin, for callers that already have one. Same parser, so they cannot disagree. */
+export async function loadGrant(cwd: string): Promise<Capability[] | null> {
+  try {
+    return parseGrantFile(await readFile(grantStorePath(cwd), "utf8"), cwd);
+  } catch {
+    return null;
+  }
+}
+
+export type SaveOutcome = "saved" | "failed" | "busy";
+
+/**
+ * Write this directory's grant.
+ *
+ * Locked with the same lock the ledger and the approval store use, for the same reason: two sessions in one
+ * directory running `/grants init` concurrently must not interleave. A lock this cannot take yields `busy`
+ * and changes nothing — the caller reports it and the operator retries, which is the honest outcome for a
+ * write that never looked at the file (R-68).
+ *
+ * `wx` on the temp file refuses to follow a pre-existing symlink, and `rename` is atomic within a
+ * filesystem, so a reader never sees a half-written grant. Both copied from `writeFileSafely`, deliberately
+ * — a second, subtly different atomic-write is how the two come to disagree about what "safe" meant.
+ */
+export async function saveGrant(cwd: string, grant: Capability[]): Promise<SaveOutcome> {
+  const path = grantStorePath(cwd);
+  const file: GrantFile = { version: 1, cwd, grant: [...grant].sort(), writtenAt: new Date().toISOString() };
+  try {
+    await mkdir(dirname(path), { recursive: true });
+    return await withFileLock(path, "grant store", async () => {
+      const temp = `${path}.${process.pid}.${randomUUID()}.tmp`;
+      try {
+        await writeFile(temp, `${JSON.stringify(file, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+        await rename(temp, path);
+        return "saved" as const;
+      } catch {
+        await unlink(temp).catch(() => undefined);
+        return "failed" as const;
+      }
+    });
+  } catch (error) {
+    return error instanceof LockTimeoutError ? "busy" : "failed";
+  }
+}
+
+/** Remove this directory's stored grant. True when a file was there to remove. */
+export async function clearGrant(cwd: string): Promise<boolean> {
+  const path = grantStorePath(cwd);
+  try {
+    await readFile(path, "utf8");
+  } catch {
+    return false;
+  }
+  await rm(path, { force: true }).catch(() => undefined);
+  return true;
+}

package/src/skill-packages.ts

@@ -26,6 +26,7 @@
  */
 
 import { readdir, readFile, realpath } from "node:fs/promises";
+import { homedir } from "node:os";
 import { join, resolve, sep } from "node:path";
 import { ceilingForDefinition, parseSkillDefinition, type SkillDefinition } from "./definitions.ts";
 import { WILDCARD } from "./pi-tools.ts";
@@ -219,16 +220,53 @@ export async function readSkillPackage(packageDir: string): Promise<SkillPackage
  * `node_modules`: a transitive skill package is not something an operator asked to install definitions
  * from, and scaffolding one into their project would be a surprise wearing a helpful face.
  */
+/**
+ * Every place a pi package can be installed, most specific first (R-75).
+ *
+ * **Two roots, because pi has two install paths and only one of them is `npm install`.** `pi install
+ * npm:principal-pi-skills` — the documented, pi-native way, and the only one that registers the package so
+ * pi will auto-load its extension — puts it in `$PI_CODING_AGENT_DIR/npm/node_modules`, and leaves the
+ * project without a `node_modules` at all. Searching only `<cwd>/node_modules` therefore found **nothing**
+ * for an operator who followed pi's own instructions, and said "install principal-pi-skills" to somebody
+ * who just had.
+ *
+ * Measured, in a fresh `PI_CODING_AGENT_DIR` with an empty project: `pi install` populates the agent root
+ * and creates no project root.
+ *
+ * Project first when both exist, because a package pinned in the repository is the one the team agreed on.
+ */
+export function skillPackageRoots(cwd: string): string[] {
+  const agentDir = process.env.PI_CODING_AGENT_DIR ?? join(homedir(), ".pi", "agent");
+  return [join(cwd, "node_modules"), join(agentDir, "npm", "node_modules")];
+}
+
 export async function discoverSkillPackages(cwd: string): Promise<SkillPackage[]> {
-  const root = join(cwd, "node_modules");
+  const dirs: string[] = [];
+  const seenNames = new Set<string>();
+  for (const root of skillPackageRoots(cwd)) await collectFrom(root, dirs);
+
+  const packages: SkillPackage[] = [];
+  for (const dir of dirs) {
+    const found = await readSkillPackage(dir);
+    // First root wins on a name collision: the project's pinned copy outranks the machine-wide one, and
+    // silently preferring the other would make a committed lockfile stop meaning anything.
+    if (found && !seenNames.has(found.name)) {
+      seenNames.add(found.name);
+      packages.push(found);
+    }
+  }
+  return packages.sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/** Append every package directory under one `node_modules`, scoped packages included. */
+async function collectFrom(root: string, dirs: string[]): Promise<void> {
   let entries: string[];
   try {
     entries = await readdir(root);
   } catch {
-    return []; // no node_modules is a normal state, not a failure
+    return; // a root that does not exist is a normal state, not a failure
   }
 
-  const dirs: string[] = [];
   for (const entry of entries.sort()) {
     if (entry.startsWith(".")) continue; // .bin, .package-lock.json
     if (entry.startsWith("@")) {
@@ -241,11 +279,4 @@ export async function discoverSkillPackages(cwd: string): Promise<SkillPackage[]
       dirs.push(join(root, entry));
     }
   }
-
-  const packages: SkillPackage[] = [];
-  for (const dir of dirs) {
-    const found = await readSkillPackage(dir);
-    if (found) packages.push(found);
-  }
-  return packages.sort((a, b) => a.name.localeCompare(b.name));
 }